Bug 11982 - Wireshark stack-based out-of-bounds read in nettrace_3gpp_32_423_file_open
Summary: Wireshark stack-based out-of-bounds read in nettrace_3gpp_32_423_file_open
Status: RESOLVED FIXED
Alias: None
Product: Wireshark
Classification: Unclassified
Component: Capture file support (libwiretap) (show other bugs)
Version: Git
Hardware: All All
: Low Major (vote)
Target Milestone: ---
Assignee: Bugzilla Administrator
URL:
Depends on:
Blocks:
 
Reported: 2016-01-08 11:26 UTC by Mateusz Jurczyk
Modified: 2016-02-26 17:19 UTC (History)
0 users

See Also:

Attachments
Reproducers. (887 bytes, application/zip)
2016-01-08 11:26 UTC, Mateusz Jurczyk 		Details
unzip file 1 (3.56 KB, application/xml)
2016-01-13 03:52 UTC, Michael Mann 		Details
unzip file 2 (1.01 KB, application/xml)
2016-01-13 03:52 UTC, Michael Mann 		Details
unzip file 3 (3.16 KB, application/xml)
2016-01-13 03:53 UTC, Michael Mann 		Details
Show Obsolete (1) Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mateusz Jurczyk 2016-01-08 11:26:51 UTC 
Created attachment 14214 [details]
Reproducers.

Build Information:
Wireshark git master.
--
The following crash due to a stack-based out-of-bounds read can be observed in an ASAN build of Wireshark (current git master), by feeding a malformed file to tshark ("$ ./tshark -nVxr /path/to/file"):

Attached are three files which trigger the crash.

--- cut ---
==23220==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fffc04c9c20 at pc 0x00000046cc29 bp 0x7fffc04c99b0 sp 0x7fffc04c9160
READ of size 515 at 0x7fffc04c9c20 thread T0
    #0 0x46cc28 in StrstrCheck(void*, char*, char const*, char const*) llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:314
    #1 0x46d0f7 in __interceptor_strstr llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:328
    #2 0x7fbfa4361585 in nettrace_3gpp_32_423_file_open wireshark/wiretap/nettrace_3gpp_32_423.c:986:13
    #3 0x7fbfa429fc7c in wtap_open_offline wireshark/wiretap/file_access.c:913:11
    #4 0x51dd9d in cf_open wireshark/tshark.c:4195:9
    #5 0x5178cb in main wireshark/tshark.c:2188:9

Address 0x7fffc04c9c20 is located in stack of thread T0 at offset 544 in frame
    #0 0x7fbfa43611ff in nettrace_3gpp_32_423_file_open wireshark/wiretap/nettrace_3gpp_32_423.c:964

  This frame has 1 object(s):
    [32, 544) 'magic_buf' <== Memory access at offset 544 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:314 in StrstrCheck(void*, char*, char const*, char const*)
Shadow bytes around the buggy address:
  0x100078091330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100078091340: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
  0x100078091350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100078091360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x100078091370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100078091380: 00 00 00 00[f3]f3 f3 f3 f3 f3 f3 f3 00 00 00 00
  0x100078091390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000780913a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000780913b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000780913c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000780913d0: f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==23220==ABORTING
--- cut ---

This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
Comment 1 Anders Broman 2016-01-12 16:31:37 UTC 
Hi,
I could not reproduce the crash with Wireshark from top of trunk but I have
made a potential fix in https://code.wireshark.org/review/#/c/13233/
Comment 2 Michael Mann 2016-01-13 03:49:53 UTC 
(In reply to Anders Broman from comment #1)
> Hi,
> I could not reproduce the crash with Wireshark from top of trunk but I have
> made a potential fix in https://code.wireshark.org/review/#/c/13233/

Fixed submitted
Comment 3 Gerrit Code Review 2016-01-13 03:50:44 UTC 
Change 13249 had a related patch set uploaded by Michael Mann:
nettrace_3gpp_32_423 Protect from buffer overun.

https://code.wireshark.org/review/13249
Comment 4 Michael Mann 2016-01-13 03:52:31 UTC 
Created attachment 14231 [details]
unzip file 1

Unzipped for the fuzzbots.
Comment 5 Michael Mann 2016-01-13 03:52:48 UTC 
Created attachment 14232 [details]
unzip file 2

Unzipped for the fuzzbots
Comment 6 Michael Mann 2016-01-13 03:53:33 UTC 
Created attachment 14233 [details]
unzip file 3

Unzipped for the fuzzbots
Comment 7 Gerrit Code Review 2016-01-13 07:32:07 UTC 
Change 13249 merged by Anders Broman:
nettrace_3gpp_32_423 Protect from buffer overun.

https://code.wireshark.org/review/13249